UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
40,019
Published in 7 days
1,112
Critical in 30 days
386
Actively exploited
423

Latest vulnerabilities

40,019 vulnerabilities
  1. High 7.5

    CVE-2015-7857 · Joomla!

    SQL injection vulnerability in the getListQuery function in administrator/components/com_contenthistory/models/history.php in Joomla! 3.2 before 3.4.5 allows remote attackers to execute arbitrary SQL commands via the list[select] parameter to index.php.

    Published 29 Oct 2015 · NVD
  2. High 7.5

    CVE-2015-7297 · Joomla!

    SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.

    Published 29 Oct 2015 · NVD
  3. Medium 5.0

    CVE-2015-7873 · phpMyAdmin

    The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter.

    Published 28 Oct 2015 · NVD
  4. Medium 6.4

    CVE-2015-5289 · PostgreSQL

    Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.

    Published 26 Oct 2015 · Fixed in 9.3.10, 9.4.5 · NVD
  5. Medium 6.4

    CVE-2015-5288 · PostgreSQL

    The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.

    Published 26 Oct 2015 · NVD
  6. High 7.8

    CVE-2015-6327 · Cisco ASA and Firepower Threat Defense

    The IKEv1 implementation in Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.8), 9.2 before 9.2(4), and 9.3 before 9.3(3) allows remote attackers to cause a denial of service (device reload) via crafted ISAKMP UDP packets, aka Bug ID CSCus94026.

    Published 25 Oct 2015 · NVD
  7. High 7.8

    CVE-2015-6326 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(1.5) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response, aka Bug ID CSCuu07799.

    Published 25 Oct 2015 · NVD
  8. High 7.1

    CVE-2015-6325 · Cisco ASA and Firepower Threat Defense

    Cisco Adaptive Security Appliance (ASA) software 7.2 and 8.2 before 8.2(5.58), 8.3 and 8.4 before 8.4(7.29), 8.5 through 8.7 before 8.7(1.17), 9.0 before 9.0(4.37), 9.1 before 9.1(6.4), 9.2 before 9.2(4), 9.3 before 9.3(3.1), and 9.4 before 9.4(1.1) allows remote attackers to cause a denial of service (device reload) via a crafted DNS response, aka Bug ID CSCut03495.

    Published 25 Oct 2015 · NVD
  9. High 7.1

    CVE-2015-6324 · Cisco ASA and Firepower Threat Defense

    The DHCPv6 relay implementation in Cisco Adaptive Security Appliance (ASA) software 9.0 before 9.0(4.37), 9.1 before 9.1(6.6), 9.2 before 9.2(4), 9.3 before 9.3(3.5), and 9.4 before 9.4(2) allows remote attackers to cause a denial of service (device reload) via crafted DHCPv6 packets, aka Bug IDs CSCus56252 and CSCus57142.

    Published 25 Oct 2015 · NVD
  10. Medium 5.0

    CVE-2015-4916 · Java

    Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4908.

    Published 22 Oct 2015 · NVD
  11. Low 3.5

    CVE-2015-4913 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858.

    Published 22 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  12. Medium 5.0

    CVE-2015-4911 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4893.

    Published 22 Oct 2015 · NVD
  13. Low 2.1

    CVE-2015-4910 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.

    Published 22 Oct 2015 · NVD
  14. Medium 5.0

    CVE-2015-4908 · Java

    Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4916.

    Published 22 Oct 2015 · NVD
  15. Medium 5.0

    CVE-2015-4906 · Java

    Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.

    Published 22 Oct 2015 · NVD
  16. Medium 4.0

    CVE-2015-4905 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML.

    Published 22 Oct 2015 · NVD
  17. Medium 4.0

    CVE-2015-4904 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to libmysqld.

    Published 22 Oct 2015 · NVD
  18. Medium 5.0

    CVE-2015-4903 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to RMI.

    Published 22 Oct 2015 · NVD
  19. Medium 5.3Actively exploited

    CVE-2015-4902 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

    Published 22 Oct 2015 · NVD
  20. High 9.3

    CVE-2015-4901 · Java

    Unspecified vulnerability in Oracle Java SE 8u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.

    Published 22 Oct 2015 · NVD
  21. Low 3.5

    CVE-2015-4895 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

    Published 21 Oct 2015 · Fixed in 10.0.21, 10.1.8 · NVD
  22. Medium 5.0

    CVE-2015-4893 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.

    Published 21 Oct 2015 · NVD
  23. Low 3.5

    CVE-2015-4890 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Replication.

    Published 21 Oct 2015 · NVD
  24. High 10.0

    CVE-2015-4883 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4860.

    Published 21 Oct 2015 · NVD
  25. Medium 5.0

    CVE-2015-4882 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.

    Published 21 Oct 2015 · NVD
  26. High 10.0

    CVE-2015-4881 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4835.

    Published 21 Oct 2015 · NVD
  27. Medium 4.6

    CVE-2015-4879 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to DML.

    Published 21 Oct 2015 · Fixed in 5.5.45, 10.0.21, 10.1.8 · NVD
  28. Medium 5.0

    CVE-2015-4872 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect integrity via unknown vectors related to Security.

    Published 21 Oct 2015 · NVD
  29. Medium 5.8

    CVE-2015-4871 · Java

    Unspecified vulnerability in Oracle Java SE 7u85 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries.

    Published 21 Oct 2015 · NVD
  30. Medium 4.0

    CVE-2015-4870 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : Parser.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  31. High 7.6

    CVE-2015-4868 · Java

    Unspecified vulnerability in Oracle Java SE 8u60 and Java SE Embedded 8u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 21 Oct 2015 · NVD
  32. Medium 4.0

    CVE-2015-4866 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

    Published 21 Oct 2015 · Fixed in 10.0.18, 10.1.8 · NVD
  33. Low 3.5

    CVE-2015-4864 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.

    Published 21 Oct 2015 · Fixed in 5.5.44, 10.0.20, 10.1.8 · NVD
  34. Medium 4.0

    CVE-2015-4862 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML.

    Published 21 Oct 2015 · NVD
  35. Low 3.5

    CVE-2015-4861 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  36. High 10.0

    CVE-2015-4860 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI, a different vulnerability than CVE-2015-4883.

    Published 21 Oct 2015 · NVD
  37. Medium 4.0

    CVE-2015-4858 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via vectors related to DML, a different vulnerability than CVE-2015-4913.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  38. High 10.0

    CVE-2015-4844 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.

    Published 21 Oct 2015 · NVD
  39. High 10.0

    CVE-2015-4843 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.

    Published 21 Oct 2015 · NVD
  40. Medium 5.0

    CVE-2015-4842 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.

    Published 21 Oct 2015 · NVD
  41. Medium 5.0

    CVE-2015-4840 · Java

    Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.

    Published 21 Oct 2015 · NVD
  42. Low 2.8

    CVE-2015-4836 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : SP.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  43. High 10.0

    CVE-2015-4835 · Java

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2015-4881.

    Published 21 Oct 2015 · NVD
  44. Medium 4.0

    CVE-2015-4833 · MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.

    Published 21 Oct 2015 · NVD
  45. Medium 4.0

    CVE-2015-4830 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  46. Medium 4.0

    CVE-2015-4826 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Types.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  47. High 7.2

    CVE-2015-4819 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and 5.6.25 and earlier, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Client programs.

    Published 21 Oct 2015 · Fixed in 5.5.45, 10.0.21, 10.1.8 · NVD
  48. Medium 4.0

    CVE-2015-4816 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.

    Published 21 Oct 2015 · Fixed in 5.5.45, 10.0.21, 10.1.8 · NVD
  49. Medium 4.0

    CVE-2015-4815 · MariaDB, MySQL

    Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DDL.

    Published 21 Oct 2015 · Fixed in 5.5.46, 10.0.22, 10.1.8 · NVD
  50. Medium 6.9

    CVE-2015-4810 · Java

    Unspecified vulnerability in Oracle Java SE 7u85 and 8u60 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.

    Published 21 Oct 2015 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.